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REMARKS 

By this amendment, claims 1-15 are pending, in which no claim is canceled, withdrawn 
from consideration, or newly presented. Claim 6 is currently amended. No new matter is 
introduced. 

The Office Action mailed July 12, 2007 provisionally rejected claims 1, 3, 5, 8, and 10 
under obviousness-type double patenting as unpatentable over claim 1 of copending Application 
Serial No. 10/024,202, and rejected claim 6 under 35 U.S.C. § 112, second paragraph, as being 
indefinite, claims 1, 3, 5, 6, 8, and 10-15 as obvious under 35 U.S.C. § 103 based on Hypponen 
et al. (US 2003/0191957) in view of Yanovsky (US 7,010,807), and claims 2, 4, 7, and 9 as 
obvious under 35 U.S.C. § 103 based on Hypponen et al. (US 2003/0191957) in view of 
Yanovsky (US 7,010,807) and further in view of Network Associates. 

REJECTION OF CLAIMS 1, 3, 5. 8. AND 10 UNDER OBVIOUSNESS-TYPE 
DOUBLE PATENTING OVER CLAIM 1 OF CO-PENDING APPLICATION 
10/024,202 

This rejection was addressed in the Appeal Brief of March 16, 2007. The Examiner has 
re-opened prosecution but continues to maintain this rejection with no further explanation and 
without being responsive to Applicants' arguments therein. At page 8 of the latest Office 
Action of July 12, 2007, the Examiner states that Applicants' arguments in the Appeal Brief 
"with respect to claims 1-15 have been considered but are moot in view of the new ground(s) of 
rejection." However, Applicants' arguments are not moot since the Examiner has maintained 
the rejection under obviousness -type double patenting. Therefore, Applicants basically repeat 
those arguments herein. 

Whereas instant claim 1 is silent as to any security manager and the taking of any action 
responsive to detection of a malicious code, claim 1 of Application Serial No. 10/024,202 recites 
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that "in response to detection of an instance of malicious code, generating and transmitting an 
event indicating the detection to a security manager." 

Whereas instant claim 3 recites "a mail proxy server for determining whether the 
incoming electronic mail is to be scanned for malicious code...," claim 1 of Application Serial 
No. 10/024,202 is silent as to any such mail proxy server. 

Whereas instant claim 5 recites a "plurality of scanning systems," a "plurality of anti- 
virus servers," and a "plurality of switches," claim 1 of Application Serial No. 10/024,202 recites 
only a single one of each of these elements. 

Whereas instant claim 8 is directed to a "method for maintaining network security system 
between a plurality of intranets belonging to respective organizations and an internet backbone, 
comprising: directing incoming electronic mail from the internet backbone to a scaiming system; 
scarming incoming electronic mail for malicious code; and downloading anti-virus code to clients 
coupled to the intranets," claim 1 of Application Serial No. 10/024,202 recites no such method. 

Whereas instant claim 10 recites "at the one of the mail proxy servers, determining 
whether the incoming electronic mail is to be scanned for malicious code," claim 1 of 
Application Serial No. 10/024,202 recites no mail proxy servers at all. 

As has been the case throughout this lengthy and belabored prosecution, the Examiner 
fails to indicate in the latest Office Action of July 12, 2007, specifically why the subject matter of 
each of instant claims 1, 3, 5, 8, and 10, with the differences over claim 1 of Application Serial 
No. 10/024,202, as indicated supra, would have been obvious over claim 1 of Application Serial 
No. 10/024,202. Therefore, the Examiner has failed to present a prima facie case regarding the 
obviousness of the instant claimed subject matter. 

The Examiner's rationale for the obviousness-type double patenting rejection, as it 
appears in the latest Office Action of July 12, 2007, at page 3, reads, in toto, as follows: 
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The subject matter claimed in the instant application is fully disclosed 
in the referenced copending application and would be covered by any 
patent granted on that copending application since the referenced copending 
application and the instant application are claiming common subject matter, 
as follows: co-pending applications and present application disclose a 
scanning system, an anti-vims server, and a switch for performing the 
same virus protection procedures. The instant claims are broader in scope 
to the claims for co-pending application and are therefore obvious from them. 

Merely because both applications claim a scanning system, an anti-virus server, and a 
switch for performing the same virus protection procedures is insufficient to establish 
obviousness-type double patenting because such reasoning does not take into account other, 
differing, features of the claims in each application. For example, the Examiner has not 
addressed the "mail proxy server" of instant claim 3 and why this claim would have been obvious 
over claim 1 of the copending application. 

As a further example, claim 1 of the copending application recites, "generating and 
transmitting an event indicating the detection to a security manager." This is clearly different 
from instant claim 1 which does not require this limitation. There is no requirement in the 
instant claim that upon detection of a virus, an administrator or security personnel must be 
notified of such detection, as in the claim of the copending application. A detection of a virus 
may just as well cause an elimination of that virus without ever notifying a security manager. In 
the absence of evidence to the contrary, and the Examiner has clearly proffered no such evidence, 
one cannot reasonably conclude that it would have been obvious, from a teaching of responsive 
to the detection of a malicious code, generating and transmitting an event indicating the detection 
to a security manager, to not generate and transmit such an event to a security manager, or vice 
versa. The Examiner must indicate some reason for concluding that it would have been 
obvious to eliminate "in response to detection of an instance of malicious code, generating and 
transmitting an event indicating the detection to a security manager" from claim 1 of the 
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copending application, but the Examiner has failed to set forth a cogent rationale for reaching the 
conclusion of obviousness. 

With regard to independent claims 3, 5, 8, and 10, the Examiner never deals with the 
differences, pointed out supra, between these claims and claim 1 of the copending application. 

The Examiner's entire rationale for this rejection, in a nutshell, is that "[t]he instant 
claims are broader in scope to the claims for co-pending application and are therefore obvious 
from them." The Examiner's rationale is legally flawed. Broader claims are not, per se, 
obvious over more detailed claims. While that may be the case in some instances, it is not 
always the case, and the Examiner has the initial burden of proof in showing that the broader 
claim is, indeed, obvious over the narrower. For example, as shown supra, claim 1 would not 
have been obvious over narrower claim 1 of the copending application because the narrower, 
copending claim calls for "generating and transmitting an event indicating the detection to a 
security manager" and it would not have been obvious to remove this requirement that upon 
detection of a virus, an administrator or security personnel must be notified of such detection, as 
in the claim of the copending application. A detection of a virus may just as well cause an 
elimination of that virus without ever notifying a security manager, but the copending claim 
would have suggested to the artisan that an administrator or security personnel must always be 
notified when a detection of a virus occurs. Therefore, it would not have been obvious to 
eliminate this step of notifying an administrator upon vims detection. 

Accordingly, since the Examiner has failed to establish a prima facie case of obviousness 
with regard to instant claims 1, 3, 5, 8, and 10, and because the instant claimed subject matter is 
patentably distinct over claim 1 of co-pending application 10/024,202, the Examiner is 
respectfully requested to withdraw the rejection of these claims under obviousness-type double 
patenting. 
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REJECTION OF CLAIM 6 UNDER 35 U.S.C. ^ 1 12, SECOND PARAGRAPH 

The Examiner's rejection of claim 6 as being indefinite because of a lack of antecedent 
basis for "the decoy servers" on line 3 should now be overcome by the current amendment in 
having claim 6 depend from claim 7, rather than from claim 5. 

Accordingly, the Examiner is respectfully requested to withdraw the rejection of claim 6 
under 35 U.S.C. § 1 12, second paragraph. 

REJECTION UNDER 35 U.S.C. $ 103 

Applicants respectfully traverse the rejection of claims 1-15 under 35 U.S.C. § 103. 

The primary reference to Hypponen et al. has previously been applied and withdrawn. 
As explained in Applicants' response of May 3, 2005, Hypponen et al. only shows one computer 
data network 1 in addition to the Internet 5 and has no disclosure of a "plurality of intranets," 
much less a "scanning system coupled to the intranets," as claimed. While the latest Office 
Action of July 12, 2007 again relies on the network (presumably network 1) of Hypponen et al. 
as an "intranet," the present claims require a "plurality of intranets." Hypponen et al. lacks any 
teaching of a "plurality of intranets" and of a scarming system "coupled to the intranets" as well 
as an anti-virus server "coupled to the intranets." The newly cited reference to Yanovsky, cited 
for an alleged teaching of an internet access module for updating anti-virus protection on network 
devices by periodically updating network devices (column 1, line 66 -column 2, line 11) (see the 
Office Action of July 12, 2007 - page 5) fails to provide for the "plurality of intranets" missing 
from Hypponen et al. Accordingly, no prima facie case of obviousness has been established. 

Moreover, the Network Associates reference, cited in the rejection of claims 2, 4, 7, and 
9, as allegedly disclosing a decoy server used to trace and track hackers and reporting all 
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intrusive activities (Network Associates-page 1) (see Office Action of July 12, 2007 ^ page 8), 
also does not provide for the deficiency in Hypponen et ah, regarding a "plurality of intranets." 

Applicants respectfully express their displeasure with the tactics employed by the USPTO 
during the protracted prosecution of this application. The Examiner's rejection of claim 6 under 
35 U.S.C. § 112, second paragraph, as lacking antecedent basis had merit, and Applicants can 
understand this, although a simple telephone call could have taken care of this minor problem. 
But what Applicants do take umbrage with is the repeat of the rejection under obviousness-type 
double patenting which has been the same throughout the prosecution and through the filing of 
two Appeal Briefs, and the withdrawal, once again, of a rejection under 35 U.S.C. § 103, after an 
Appeal Brief has been filed, only to have the claims rejected on substantially the same grounds as 
earlier in the prosecution, with Hypponen et al. employed as the primary reference. It is true 
that the Examiner now adds a new reference, Yanovsky, to Hypponen et al. and, technically, it is 
a new ground of rejection. However, the Examiner still relies on Hypponen et al. for the same 
reasons as in the Office Action of February 3, 2005. An Appeal Brief, appealing this reasoning, 
was filed on December 23, 2005, arguing against this reasoning by the Examiner. The 
Examiner's response was to re-open prosecution, and apply new references, including a primary 
reference to Bates. An argument against this reference was pursued all the way to an Appeal 
Brief, filed March 16, 2007. In response, the Examiner again re-opened prosecution and now 
returns to the rejection of the same claims based, once again, on Hypponen et al. This 
"revolving-door" prosecution has been unnecessarily expensive for Applicants, through no fault 
of their own, for more than six years of prosecution, and Applicants demand that this unfair 
practice cease. 

In particular. Applicants would respectfiilly request that the Examiner now withdraw all 
pending rejections and issue this application forthwith or, alternatively, when Applicants file 
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their next Appeal Brief in response to the Examiner's next Office Action rejecting the instant 
claims, the Examiner should file the Answer and finally permit the Board of Patent Appeals and 
Interferences to adjudicate this case. 

Therefore, the present application, as amended, overcomes the rejections of record and is 
in condition for allowance. Favorable consideration is respectfully requested. If any 
unresolved issues remain, it is respectfully requested that the Examiner telephone the 
undersigned attorney at (703) 519-9952 so that such issues may be resolved as expeditiously as 
possible. 



Respectfully Submitted, 



DITTHAVONG MORI & STEINER, P.C. 





Attorney/ Agent for Applicant(s) 
Reg. No. 44658 



918 Prince Street 
Alexandria, VA 22314 
Tel. (703) 519-9952 
Fax. (703) 519-9958 
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